296 lines
7.7 KiB
YAML
296 lines
7.7 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: fc-media
|
|
labels:
|
|
app.kubernetes.io/name: fc-media
|
|
app.kubernetes.io/part-of: flowercore
|
|
---
|
|
apiVersion: onepassword.com/v1
|
|
kind: OnePasswordItem
|
|
metadata:
|
|
name: media-oidc-client
|
|
namespace: fc-media
|
|
labels:
|
|
app.kubernetes.io/name: fc-media-web
|
|
app.kubernetes.io/part-of: flowercore
|
|
spec:
|
|
itemPath: "vaults/IAmWorkin/items/media-oidc-client"
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: fc-media-config
|
|
namespace: fc-media
|
|
labels:
|
|
app.kubernetes.io/name: fc-media-web
|
|
app.kubernetes.io/part-of: flowercore
|
|
data:
|
|
appsettings.Production.json: |
|
|
{
|
|
"DatabaseProvider": "Sqlite",
|
|
"ConnectionStrings": {
|
|
"Sqlite": "Data Source=/data/media.db"
|
|
},
|
|
"FlowerCore": {
|
|
"Auth": {
|
|
"Enabled": true,
|
|
"Oidc": {
|
|
"Authority": "https://id.iamworkin.lan/application/o/media/",
|
|
"ClientId": "media",
|
|
"ClientSecret": "",
|
|
"Audience": "media",
|
|
"RequireHttpsMetadata": true
|
|
}
|
|
},
|
|
"Tenant": {
|
|
"JwtClaimsEnabled": false,
|
|
"DefaultTenantHosts": [ "media.iamworkin.lan" ]
|
|
}
|
|
},
|
|
"Media": {
|
|
"LibraryRoot": "/media/library",
|
|
"Sources": [
|
|
{
|
|
"Name": "BlueJayNAS Video",
|
|
"Driver": "Nfs",
|
|
"MountedPath": "/media/library",
|
|
"RemotePath": "nfs://10.0.58.3/volume1/video",
|
|
"IsEnabled": true,
|
|
"IsDefault": true,
|
|
"Notes": "Synology NFS media share mounted read-only inside the cluster."
|
|
}
|
|
],
|
|
"GeneratedRoot": "/data/generated",
|
|
"TranscodeRoot": "/data/transcodes",
|
|
"InboxPath": "/media/inbox",
|
|
"InboxScanIntervalMinutes": 5,
|
|
"ScanOnStartup": false,
|
|
"ComputeChecksums": false,
|
|
"FfmpegCommand": "ffmpeg",
|
|
"FfprobeCommand": "ffprobe",
|
|
"Hls": {
|
|
"MaxConcurrentJobs": 1
|
|
},
|
|
"DefaultViewerName": "BlueJay",
|
|
"Dlna": {
|
|
"IsEnabled": true,
|
|
"MulticastAddress": "239.255.255.250",
|
|
"Port": 1900,
|
|
"DiscoveryTimeoutSeconds": 2,
|
|
"DescriptionFetchTimeoutSeconds": 2,
|
|
"MaxResponsesPerSearchTarget": 32,
|
|
"SearchTargets": [
|
|
"urn:schemas-upnp-org:device:MediaRenderer:1",
|
|
"urn:schemas-upnp-org:device:MediaServer:1"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: fc-media-data
|
|
namespace: fc-media
|
|
labels:
|
|
app.kubernetes.io/name: fc-media-web
|
|
app.kubernetes.io/part-of: flowercore
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 20Gi
|
|
storageClassName: longhorn
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: fc-media-web
|
|
namespace: fc-media
|
|
labels:
|
|
app: fc-media-web
|
|
app.kubernetes.io/name: fc-media-web
|
|
app.kubernetes.io/part-of: flowercore
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: fc-media-web
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: fc-media-web
|
|
app.kubernetes.io/name: fc-media-web
|
|
app.kubernetes.io/part-of: flowercore
|
|
annotations:
|
|
prometheus.io/scrape: "true"
|
|
prometheus.io/port: "5200"
|
|
prometheus.io/path: "/metrics"
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: rke2-server
|
|
containers:
|
|
- name: fc-media-web
|
|
image: localhost/fc-media-web:v20260604-oidc-proper
|
|
imagePullPolicy: Never
|
|
ports:
|
|
- containerPort: 5200
|
|
name: http
|
|
env:
|
|
- name: ASPNETCORE_ENVIRONMENT
|
|
value: Production
|
|
- name: ASPNETCORE_URLS
|
|
value: http://+:5200
|
|
- name: FlowerCore__Auth__Enabled
|
|
value: "true"
|
|
- name: FlowerCore__Auth__Oidc__Enabled
|
|
value: "true"
|
|
- name: FlowerCore__Auth__Oidc__Audience
|
|
value: "media"
|
|
- name: FlowerCore__Auth__Oidc__ClientId
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: media-oidc-client
|
|
key: client_id
|
|
optional: true
|
|
- name: FlowerCore__Auth__Oidc__ClientSecret
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: media-oidc-client
|
|
key: client_secret
|
|
optional: true
|
|
- name: FlowerCore__Auth__Oidc__Authority
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: media-oidc-client
|
|
key: issuer_url
|
|
optional: true
|
|
resources:
|
|
requests:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
limits:
|
|
cpu: "4"
|
|
memory: 4Gi
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /app/appsettings.Production.json
|
|
subPath: appsettings.Production.json
|
|
readOnly: true
|
|
- name: data
|
|
mountPath: /data
|
|
- name: transcodes
|
|
mountPath: /data/transcodes
|
|
- name: media-library
|
|
mountPath: /media/library
|
|
readOnly: true
|
|
- name: media-inbox
|
|
mountPath: /media/inbox
|
|
startupProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 5200
|
|
httpHeaders:
|
|
- name: X-Forwarded-Proto
|
|
value: https
|
|
failureThreshold: 18
|
|
periodSeconds: 10
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 5200
|
|
httpHeaders:
|
|
- name: X-Forwarded-Proto
|
|
value: https
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 5200
|
|
httpHeaders:
|
|
- name: X-Forwarded-Proto
|
|
value: https
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: fc-media-config
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: fc-media-data
|
|
- name: transcodes
|
|
nfs:
|
|
server: 10.0.58.3
|
|
path: /volume1/kubernetes/fc-media-transcodes
|
|
- name: media-inbox
|
|
nfs:
|
|
server: 10.0.58.3
|
|
path: /volume1/kubernetes/fc-media-inbox
|
|
- name: media-library
|
|
nfs:
|
|
server: 10.0.58.3
|
|
path: /volume1/video
|
|
readOnly: true
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: fc-media-web
|
|
namespace: fc-media
|
|
labels:
|
|
app: fc-media-web
|
|
app.kubernetes.io/name: fc-media-web
|
|
app.kubernetes.io/part-of: flowercore
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: fc-media-web
|
|
ports:
|
|
- port: 5200
|
|
targetPort: 5200
|
|
protocol: TCP
|
|
name: http
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: fc-media-tls
|
|
namespace: fc-media
|
|
labels:
|
|
app.kubernetes.io/name: fc-media-web
|
|
app.kubernetes.io/part-of: flowercore
|
|
spec:
|
|
secretName: fc-media-tls
|
|
issuerRef:
|
|
name: step-ca-acme
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- media.iamworkin.lan
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: fc-media-web
|
|
namespace: fc-media
|
|
labels:
|
|
app.kubernetes.io/name: fc-media-web
|
|
app.kubernetes.io/part-of: flowercore
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- match: Host(`media.iamworkin.lan`)
|
|
kind: Rule
|
|
services:
|
|
- name: fc-media-web
|
|
port: 5200
|
|
tls:
|
|
secretName: fc-media-tls
|